using System.Security.Cryptography;

namespace ZB.MOM.WW.Auth.ApiKeys;

internal static class ApiKeySecretGenerator
{
    /// <summary>
    /// Generates a new cryptographically secure API key secret.
    /// Returns 32 random bytes encoded as URL-safe base64 (no padding, no '+', no '/').
    /// </summary>
    public static string NewSecret()
    {
        Span<byte> bytes = stackalloc byte[32];
        RandomNumberGenerator.Fill(bytes);

        return Convert.ToBase64String(bytes)
            .TrimEnd('=')
            .Replace('+', '-')
            .Replace('/', '_');
    }
}
